JWT token compromise can allow malicious actions including Remote Code Execution (RCE) in github.com/neuvector/neuvector

MEDIUM 5.5CVE-2023-22644 · GO-2024-3201 · Published 20/09/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/neuvector/neuvector Go	`< 0.0.0-20231003121714-be746957ee7c`	`0.0.0-20231003121714-be746957ee7c`
manager server suse	`≥ 4.2, < 4.2.50-150300.3.66.5≥ 4.3, < 4.3.58-150400.3.46.4`	`4.2.50-150300.3.66.54.3.58-150400.3.46.4`

Description

NVD description

A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.

References

nvd.nist.gov/vuln/detail/CVE-2023-22644 · ADVISORY
bugzilla.suse.com/show_bug.cgi · WEB
neuvector/neuvector security advisory · WEB
bugzilla.suse.com/show_bug.cgi

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free